📚 Encryption | 加密
Encryption is the process of converting readable data, known as plaintext, into a scrambled, unreadable format called ciphertext. Only authorised parties can reverse the process using a secret key. In our interconnected digital world, encryption underpins everything from online banking to private messaging, making it a vital topic in IGCSE Computer Science. This article will walk you through the core principles of encryption, covering symmetric and asymmetric methods, hashing, digital signatures, and practical applications such as SSL/TLS.
加密是将可读的数据（称为明文）转换为不可读的格式（称为密文）的过程。只有经过授权的一方才能使用密钥将密文还原。在万物互联的数字世界中，加密支撑着从网上银行到私人聊信的方方面面，因此是IGCSE计算机科学中的重要考点。本文将带你深入理解加密的核心原理，涵盖对称加密与非对称加密、哈希、数字签名以及SSL/TLS等实际应用。
1. What is Encryption? | 什么是加密？
Encryption is the mathematical scrambling of data so that it can only be read by someone who possesses the correct decryption key. The original, intelligible message is called plaintext. After applying an encryption algorithm and a key, it becomes ciphertext, which appears as a random string of characters to anyone intercepting it.
加密是对数据进行的数学变换，只有拥有正确解密密钥的人才能读取。原始的、可理解的消息称为明文。通过加密算法和密钥处理后，明文变成密文，对于截获者来说，密文看起来像是随机的字符序列。
An encryption algorithm, or cipher, is the set of rules that define how to convert plaintext into ciphertext, and vice versa. Modern ciphers are complex mathematical functions, but the concept remains the same as ancient methods: hide the message in plain sight.
加密算法（或称密码）是定义如何将明文转换为密文（及反向转换）的一组规则。现代密码是复杂的数学函数，但其基本概念与古代方法一致：把消息隐藏在显而易见的地方。
2. Why is Encryption Important? | 加密的重要性
Encryption provides confidentiality, ensuring that sensitive information—such as passwords, credit card numbers, and personal emails—remains private. Without encryption, any data transmitted over a network could be read by eavesdroppers. Encryption also helps maintain data integrity by making it much harder for attackers to alter a message without detection.
加密提供机密性，确保密码、信用卡号和个人邮件等敏感信息保持私密。没有加密，通过网络传输的任何数据都可能被窃听者读取。加密还可以通过使攻击者难以在不被发现的情况下篡改消息，从而帮助维护数据完整性。
Furthermore, encryption supports authentication and non‑repudiation when combined with digital signatures. It is the backbone of secure online transactions, e‑commerce, and modern communication platforms. For IGCSE CCEA Computer Science, you need to appreciate encryption as a fundamental tool for network security.
此外，与数字签名结合时，加密还支持身份验证和不可否认性。加密是安全在线交易、电子商务和现代通信平台的基石。在IGCSE CCEA计算机科学中，你需要理解加密是网络安全的基本工具。
3. Plaintext and Ciphertext | 明文与密文
Plaintext is the original, readable form of the data. For example, the message ‘HELLO’ is plaintext. After encryption, this might become something like ‘KHOOR’ (using a simple shift cipher) or a far more complex string such as ‘a8F3xQ1z’. The transformed data is the ciphertext.
明文是数据的原始可读形式。例如，消息“HELLO”是明文。加密后，它可能变成类似“KHOOR”的内容（使用简单的移位密码），或者更复杂的字符串如“a8F3xQ1z”。转换后的数据即为密文。
The strength of an encryption system often depends on the algorithm and the secrecy of the key, not on keeping the algorithm itself secret. This principle is known as Kerckhoffs’s principle. In modern cryptography, algorithms are publicly known and tested, while security relies on the key.
加密系统的强度通常取决于算法和密钥的保密性，而不是算法本身的保密。这一原则被称为柯克霍夫原则。在现代密码学中，算法是公开已知并经过测试的，安全性依赖于密钥。
4. Symmetric Encryption | 对称加密
Symmetric encryption uses the same key for both encryption and decryption. The sender encrypts the plaintext with the key, and the recipient uses the identical key to recover the plaintext. This means the key must be shared between the two parties securely beforehand.
对称加密使用同一个密钥进行加密和解密。发送方用密钥加密明文，接收方使用完全相同的密钥恢复明文。这意味着必须先以安全的方式在两方之间共享该密钥。
Symmetric algorithms are fast and efficient for bulk data encryption. Common examples include AES (Advanced Encryption Standard) and the older DES (Data Encryption Standard). A major drawback is key distribution: how do you safely share the secret key without it being intercepted?
对称算法速度快、效率高，适合大批量数据加密。常见的例子包括AES（高级加密标准）和较老的DES（数据加密标准）。对称加密的主要缺点是密钥分发问题：如何安全地共享密钥而不被截获？
- Fast and uses less computational power | 速度快，占用计算资源较少
- Same key for encryption and decryption | 加密和解密使用同一密钥
- Key must remain secret between parties | 密钥必须在双方之间保密
- Key distribution is a challenge | 密钥分发是一个挑战
5. Asymmetric Encryption | 非对称加密
Asymmetric encryption, also known as public‑key cryptography, uses two mathematically related keys: a public key and a private key. The public key can be shared openly, while the private key is kept secret. Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa.
非对称加密，又称公钥加密，使用两个数学上相关的密钥：公钥和私钥。公钥可以公开发布，私钥必须保密。用公钥加密的数据只能用对应的私钥解密，反之亦然。
This solves the key distribution problem: anyone can encrypt a message using the recipient’s public key, but only the recipient possesses the private key to decrypt it. RSA (Rivest–Shamir–Adleman) is one of the most widely used asymmetric algorithms. However, asymmetric encryption is slower and more computationally intensive than symmetric encryption.
这解决了密钥分发问题：任何人都可以使用接收者的公钥加密消息，但只有接收者拥有私钥来解密。RSA（Rivest–Shamir–Adleman）是最广泛使用的非对称算法之一。然而，非对称加密比对称加密慢，且计算量更大。
C = Mᵉ mod n (encryption), M = Cᵈ mod n (decryption) – RSA core
C = Mᵉ mod n（加密），M = Cᵈ mod n（解密）—— RSA核心
6. The Caesar Cipher | 凯撒密码
The Caesar cipher is one of the simplest symmetric encryption techniques, used in Roman times. It is a substitution cipher where each letter in the plaintext is shifted a fixed number of places down the alphabet. For example, with a shift of 3, A becomes D, B becomes E, and so on. The shift value acts as the key.
凯撒密码是最简单的对称加密技术之一，古罗马时期就已使用。它是一种替换密码，明文中的每个字母按字母表顺序移动固定位数。例如，移位3时，A变成D，B变成E，以此类推。移位值即为密钥。
Although trivial to break today, the Caesar cipher illustrates the basic concept of an encryption algorithm and a key. In an IGCSE exam, you might be asked to encrypt or decrypt a short message using a given shift. The mathematical representation is: C = (P + K) mod 26, where P and C are the positions of the plaintext and ciphertext letters, and K is the shift.
尽管今天看来很容易破解，凯撒密码展示了加密算法和密钥的基本概念。在IGCSE考试中，你可能会被要求用给定的移位加密或解密一条短消息。其数学表示为：C = (P + K) mod 26，其中P和C分别代表明文和密文字母的位置，K是移位量。
Example: HELLO with K=3 → KHOOR
示例：HELLO，K=3 → KHOOR
7. Modern Symmetric Algorithms | 现代对称算法
Modern ciphers are far more sophisticated than the Caesar cipher. They operate on blocks of bits rather than single letters. AES, for instance, works on 128‑bit blocks and supports key lengths of 128, 192, or 256 bits. It uses substitution‑permutation networks with multiple rounds of transformation, making it resistant to brute‑force attacks.
现代密码远比凯撒密码复杂。它们对位块而非单个字母进行操作。例如，AES处理128位的数据块，支持128、192或256位的密钥长度。它使用多轮变换的替代‑置换网络，能够抵抗暴力破解。
Symmetric algorithms are categorised as stream ciphers or block ciphers. Stream ciphers encrypt data one bit or byte at a time, while block ciphers process fixed‑size blocks. AES is a block cipher, often used in modes like CBC (Cipher Block Chaining) to strengthen security.
对称算法分为流密码和分组密码。流密码一次加密一个位或一个字节，分组密码则处理固定大小的数据块。AES是分组密码，常以CBC（密码块链接）等模式使用以增强安全性。
8. Public Key Infrastructure and Digital Signatures | 公钥基础设施与数字签名
Public Key Infrastructure (PKI) is a framework that manages digital keys and certificates. A digital certificate binds a public key to an entity (such as a website) and is issued by a trusted Certificate Authority (CA). This allows users to verify that a public key belongs to the claimed owner.
公钥基础设施（PKI）是管理数字密钥和证书的框架。数字证书将公钥绑定到一个实体（如网站），并由受信任的证书颁发机构（CA）签发。这使用户能够验证公钥确实属于声称的所有者。
Digital signatures use asymmetric encryption in reverse: a sender encrypts a hash of a message with their private key. The recipient decrypts it with the sender’s public key and compares the hash to ensure the message has not been tampered with and indeed came from the sender. This provides authentication and non‑repudiation.
数字签名反用非对称加密：发送方用自己的私钥加密消息的哈希值。接收方用发送方的公钥解密，并比较哈希值，以确保消息未被篡改且确实来自发送方。这提供了身份验证和不可否认性。
| Feature | 特性 | Encryption | 加密 | Digital Signature | 数字签名 |
|---|---|---|
| Key used | 使用的密钥 | Recipient’s public key | 接收者的公钥 | Sender’s private key | 发送者的私钥 |
| Purpose | 目的 | Confidentiality | 机密性 | Authentication, integrity, non‑repudiation | 身份验证、完整性、不可否认性 |
9. Hashing vs Encryption | 哈希与加密的区别
Hashing is often confused with encryption, but they serve different purposes. A hash function takes an input of any size and produces a fixed‑length string, called a hash value or digest. Hashing is a one‑way process: you cannot reverse a hash to obtain the original data. Common algorithms include SHA‑256 and MD5 (now considered broken).
哈希常与加密混淆，但它们的用途不同。哈希函数接受任意大小的输入，生成固定长度的字符串，称为哈希值或摘要。哈希是单向过程：你无法通过哈希值逆向获得原始数据。常见算法有SHA‑256和MD5（现已被认为不安全）。
Encryption is reversible with the correct key; hashing is not. Hashing is used for verifying data integrity and storing passwords securely. For instance, when you log in, your password is hashed and compared to the stored hash, so the actual password is never stored in plaintext.
加密在拥有正确密钥时可逆；哈希则不可逆。哈希用于验证数据完整性和安全存储密码。例如，登录时你的密码被哈希处理后与存储的哈希值比较，因此实际密码永远不会以明文存储。
- Encryption – two‑way function, requires a key, used for confidentiality | 加密 – 双向函数，需要密钥，用于机密性
- Hashing – one‑way function, no key, used for integrity and password storage | 哈希 – 单向函数，无密钥，用于完整性和密码存储
10. SSL/TLS and HTTPS | SSL/TLS与HTTPS
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols that provide encrypted communication over a network. When you see HTTPS in a URL, it means HTTP is being transmitted over a TLS‑encrypted connection. The padlock icon in a browser indicates a valid certificate and encrypted channel.
SSL（安全套接层）及其后继者TLS（传输层安全）是在网络上提供加密通信的协议。当你在网址中看到HTTPS时，表示HTTP通过TLS加密连接传输。浏览器中的挂锁图标表示有效的证书和加密通道。
The TLS handshake combines symmetric and asymmetric encryption for performance and security. Asymmetric encryption is used initially to exchange a symmetric session key securely. Thereafter, symmetric encryption encrypts the actual data transfer because it is faster. This is a perfect example of hybrid encryption.
TLS握手过程结合了对称和非对称加密，以兼顾性能和安全性。首先使用非对称加密安全地交换对称会话密钥，然后使用对称加密来加密实际的数据传输，因为对称加密更快。这是混合加密的完美例子。
11. Encryption in Practice | 加密实践
Encryption is used everywhere: Wi‑Fi networks use WPA2/WPA3 (which employ AES), messaging apps like WhatsApp use end‑to‑end encryption (the Signal Protocol), and file storage services encrypt data at rest. Understanding these applications helps you connect theory to real‑world scenarios for CCEA exams.
加密无处不在：Wi‑Fi网络使用WPA2/WPA3（采用AES），即时通讯应用如WhatsApp使用端到端加密（Signal协议），文件存储服务加密静态数据。理解这些应用有助于将理论与实际场景结合，应对CCEA考试。
One crucial concept is end‑to‑end encryption (E2EE), where only the communicating users can read the messages. The service provider never has access to the plaintext because the keys are stored only on the users’ devices. This prevents large‑scale surveillance and data breaches.
一个关键概念是端到端加密（E2EE），即只有通信的双方可以阅读消息。服务提供商永远无法访问明文，因为密钥仅存储在用户设备上。这可以防止大规模监控和数据泄露。
12. Summary | 总结
Encryption transforms plaintext into ciphertext to protect data confidentiality. Symmetric encryption is fast but requires a shared secret key; asymmetric encryption uses key pairs and solves key distribution. Hashing ensures data integrity, while digital signatures provide authentication. Together, these building blocks enable secure protocols like TLS, which powers the modern web.
加密将明文转换为密文，以保护数据的机密性。对称加密速度快，但需要共享密钥；非对称加密使用密钥对，解决了密钥分发问题。哈希确保数据完整性，数字签名提供身份验证。这些构建块共同构成了安全协议如TLS，支撑着现代网络。
For IGCSE CCEA Computer Science, focus on distinguishing between symmetric and asymmetric encryption, understanding the role of keys, recognising simple ciphers like Caesar, and explaining real‑world applications such as HTTPS and digital signatures.
对于IGCSE CCEA计算机科学，重点是区分对称与非对称加密，理解密钥的作用，识别凯撒密码等简单密码，并能解释HTTPS和数字签名等实际应用。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导Cancel reply